Cybersecurity group retools after funding cut

Rumors of the Multi-State Information Sharing and Analysis Center’s demise have been greatly exaggerated.

The nonprofit, known as MS-ISAC, has lost all of its federal funding but has resolved to remain a resource for state and local governments in cyber threat prevention, protection, response and recovery.

In March 2025, the Cybersecurity and Infrastructure Security Agency cut $10 million, about half of MS-ISAC’s budget. The rest of its federal funding ended in September 2025, when CISA’s cooperative agreement with MS-ISAC’s parent organization, the Center for Internet Security, expired. Once free and used by more than 18,500 government entities, MS-ISAC has moved to a membership model to replace the lost funding. Carlos Kizzee, senior vice president of MS-ISAC strategy and plans, told members of NACo’s County Technology Advisory Council during the group’s October meeting in Washington, D.C., that the shift to memberships has helped the organization tailor its offerings to its members.

“When federal funding ceased, the Center for Internet Security said we had two choices: We can either stop what we’re doing completely and restructure, or we can continue,” he said. “That would have been about $1 million a month, and the Center for Internet Security agreed to continue providing services. If you were to stop them with the cessation of federal funding, you would be harming a lot of government entities.”

The U.S. Department of Homeland Security has designated MS-ISAC as a key cybersecurity resource for state, local, tribal and territorial governments. When one member government encounters a cyber threat, the organization alerts the rest of its membership.

“We’re helping someone today with something that appears to be novel but trending,” Kizzee said. “We want to immediately capture that in an alert and push it out across our membership, so everyone is aware.”

MS-ISAC offers memberships to single organizations, groups of organizations, state governments and large jurisdictions, as well as statewide memberships that cover every level of government within a state. Sixteen states have those. Dues for single- and multiple-organization memberships are based on operating budgets, and the other options are priced by population. For organizations with annual operating budgets under $25 million, single-organization dues top out at $1,495 a year, and those organizations can request a hardship waiver when they sign up, which provides a free first year of membership.

“The MS-ISAC is not just a service provider, it’s not a contractor, it’s not a vendor,” Kizzee said. “The MS-ISAC is all of our members.” As a member-driven organization, he said they listen to their needs and develop services to address gaps in the market — particularly services they either cannot afford or cannot find commercially.

Kizzee said MS-ISAC has grown beyond sharing threat information to providing affordable services, along with support for managing and implementing them.

Members also help decide how MS-ISAC adjusts its offerings.

“Based on feedback we’ve received from local governments, from cities, towns, counties, we recognize that while states may have their own incident response capabilities, mechanisms, contracts, providers and so on, not every local government does,” Kizzee said. “And so local governments tend to have a higher interest in incident response, in self-assessments and in the protective [domain name system] service.”

He also said MS-ISAC does not aim to compete with private sector vendors.

“As a nonprofit, we’re not here to make a profit or compete with the commercial market,” he said. “What the MS-ISAC is for is to cover that gap that may exist between what’s commercially available, what I can afford, what I can maintain, what I can manage.”